Nixintel

Steven Harris | OSINT & Cyber Security Specialist | Investigator | Teach OSINT @SANSInstitute | @OSINTCurious |

[SANS Cyber Defense 🧢 @SANSDefense]

Millions of private AI conversations have leaked through share links, browser extensions, and misconfigured integrations.

Shahar Bahat shows what OSINT practitioners can learn from them, plus how to defend against your own exposure.

Watch: https://t.co/oW3LhIYzSA
#OSINT

[Nixintel @nixintel]

@AaronCTI Worst government of my lifetime in many respects, and there has been some fierce competition.

[Matthew Lesh @matthewlesh]

The government’s under-16s social media ban won’t just mean Instagram, it’s going to include Lego Play, YouTube Kids and Spotify.

This is mad — it’s the parents who are using these services for education and entertainment for their children.

[SANS Institute @SANSInstitute]

One registration. Two co-located Summits. More perspectives on the intelligence challenges shaping cybersecurity.

New for 2027, SANS #OSINTSummit and #CTISummit are coming together in Alexandria, VA, February 1–2!

Join practitioners sharing real-world research, investigative techniques, tools, and lessons learned across two closely connected disciplines: open-source intelligence and cyber threat intelligence.

With one registration, you can:

🔘 Explore how OSINT and CTI help uncover threats, understand adversaries, and inform security decisions.

🔘 Learn from different investigative approaches, real-world case studies, and emerging research.

🔘 Connect with practitioners across both communities to compare notes and share perspectives.

🗓️ Feb. 1–2
📍 Alexandria, VA

➡️ Explore OSINT Summit: https://t.co/zk23GLbx7O
➡️ Explore CTI Summit: https://t.co/TmAmU4gbWs

#OSINT #ThreatIntel #CyberSecurity

[SANS Cyber Defense 🧢 @SANSDefense]

Two days to compare approaches. Six more to build OSINT skills.

Join us at #OSINTSummit Feb. 1–2, then train Feb. 3–8 with @nixintel (SEC497) or @matt0177 (SEC587).

🎟️ Get a complimentary Summit pass with either course!

➡️ https://t.co/oUiNFFSBtT

[SANS Cyber Defense 🧢 @SANSDefense]

Sometimes the best insights come from seeing how someone else approached the same problem.

Join us at #OSINTSummit for real-world investigations, tools & techniques you can put to work.

🗓️ Feb. 1–2 | Alexandria, VA
🎟️ Space is limited

➡️ https://t.co/oUiNFFSBtT

[Guillermo Flor @guilleflorvs]

BREAKING: Revolut moved ~2,000 engineers onto self-hosted GLM for coding and pushed Claude Code and Codex to the exception list.

Per David Abitbol, who leads AI ops there: 56 Nvidia B200s, a blended 30 cents per million tokens, roughly a tenth of what they paid Anthropic and OpenAI. Engineering lead time improved 70%.

Here's the part that matters: the gains showed up when tokens stopped being rationed. Engineers quit saving AI for the hard tickets and pointed it at everything.

Frontier models become the exception, open weights become the default. That's a pricing problem for every lab heading to IPO.

h/t @OliverMolander

Would you move your team off frontier APIs if the bill dropped 90%?

[SANS Cyber Defense 🧢 @SANSDefense]

The information is out there. Can you find what matters and verify what you find?

Join us at #OSINTSummit for real-world investigations, emerging research, tools & techniques you can put to work.

🗓️ Feb. 1–2
📍 Alexandria, VA
🎟️ Space is limited

➡️ https://t.co/oUiNFFSBtT

[Big Brother Watch @BigBrotherWatch]

📵 A ‘social media ban’ isn't a policy for children's online safety - it's a national ID scheme by the back door.

Here are five things the government will not tell you about a social media ban ⤵️

[SANS Institute @SANSInstitute]

Cohorts are back 🙌 Bring your team to the ice for SANS Holiday Hack Challenge 2026. Subscribe for free: https://t.co/pwxqYSlDoY

#HolidayHack #Cybersecurity #CyberRange #SANSInstitute

[Michael Reiners @MCRReiners]

Didn't take long for Burnham's pledge to scrap digital ID (@NoToDigitalID) to be revealed as entirely hollow. Showing your passport as a prerequisite to engage with the online world is still remains state policy.

The solution was never digital ID requirements (doxxing of every user) as mandatory for every internet user in the UK and her territories. In reality, the solution was not this – it was having the family computer in the living room or the kitchen, and giving your child a nokia, rather than an Android.

Standing on the graves of children and reaching for the tools of censorship will always be seen for what it is. The only antidote to the multi-faceted censorship state in Britain is low-tech approaches to parenting, and passing the @ASI Freedom of Speech Bill: https://t.co/6ghszkTump

[Nixintel @nixintel]

ASBOs are back.

[Politics UK @PolitlcsUK]

🚨 NEW: Respect Orders are now live across England and Wales

People who cause harassment, alarm or distress to others can receive bans from town centres, anger management courses or unlimited fines

Anyone who breaches an Order can be arrested and jailed for up to 2 years

[mosesrenegade @mosesrenegade]

What I found Pre Announcement yesterday I see alot of people finding. This has been a known PHP thing, that i can remember from at least 10 years ago becuase it was in a class I wrote.

1. PHP allows you to upload a file even if there is no file upload area.
2. It then realizes that you do not have a file upload area and cleans things up
3. The bug announced recently allowed for one interesting thing: session fixation through setting the PHPSESSIONID (at least this is what I'm verifying now).
4. Given you know the name of the session ID, you can then predict the session ID file name in /tmp because many implementations will do this by default.
5. Recalling the session_id through an LFI (stock configuration) will cause the file to be read.
6. Reading the file, given that it's a serialized object, will deserialize it, giving you potential RCE.

I tried this on stock WordPress in a container, and it appeared to work. I'm unsure how widespread this is, or whether it is really a problem.

[SANS Institute @SANSInstitute]

Missed the PHP briefing? Replay is up. CVE-2026-109618 / CVE-2026-109619, the Oct 21 fix, and what to do if you are on a version that will not get one. https://t.co/11YV9kV9dc

#PHP

[The Exploding Heads @Exploding_Heads]

An important reminder for Man United fans

[SANS Cyber Defense 🧢 @SANSDefense]

📣 Deadline Extended! The SANS #OSINTSummit 2027 Call for Presentations is open for another week!

Have an OSINT case study, research project, tool, technique, or lesson learned to share? We want to hear from you!

⏰ New Deadline: Oct. 26, 5 p.m. EDT
📩 https://t.co/gQE9aZvfcZ

[Jacob Ross @j_2ross]

Zu dem analytischen Elend kommt noch das hier. Die RUS Dienste kommen doch aus dem Lachen gar nicht mehr heraus, angesichts tausender Zuschreibungen, die ihnen jeden Tag übermenschliche Einflussmöglichkeiten überall auf dem Kontinent attestieren: https://t.co/2FS6au3br1

[Paul Walsh @Paul__Walsh]

Ursula von der Leyen has confirmed that everyone in the EU will need to use the EU's app for identity authentication before being able to access or post on social media websites.

🇪🇺 As an expert in online child safety, I am here to expose the misinformation and misdirection in von der Leyen's statements.

Today von der Leyen said:

"This is not about whether children can access social media, it is about whether social media can access our children".

💡The first part is true. This isn't about children. It's about surveillance and combating political dissent. A state that can't control its own citizens is more dangerous than a state rife with criminals. The second part is a PR soundbite that politicians are using like a campaign slogan straight out of 1984.

🇪🇺"The question is no longer if children face risks online, but what can we do to give children a safer start online".

💡No. You can't give children a "safer start" online any more than you can offline. In the offline world, the government doesn't enforce curfews or ban children from entering liquor stores, bars or restaurants. That's a parent's responsibility. The digital world should be no different.

🇪🇺"The age verification app is one of the tools to get it done".

💡This is a contradiction because she also said "It won't be foolproof".

🇪🇺"It's easy to use, it is privacy preserving and it is open source".

💡The app was compromised as soon as it was released. "Privacy-preserving" age verification is an oxymoron. You can't verify a person's age without verifying their identity. Where or how that age is shared afterwards is irrelevant.

🇪🇺"This is basically about putting back the power into the hands of parents".

💡More from 1984. The EU is doing the opposite. Parents are having their authority stripped by politicians who think they know better. Many parents are capable and unaffected by peer pressure, and they know how to use parental controls to block any app classified as 13+. Some teens are safe, their parents trust them, and the state has no business overruling that trust.

🇪🇺"We don't give our children keys to the car before they have their licence"

💡Comparing an app to a car is a false equivalence used to justify mass surveillance. Governments don't decide when a young person is ready for car keys, guardians do.

💡Forcing every adult and child into a biometric checkpoint just to use an app or website is not licensing drivers. It's the state seizing everyone's keys, locking the garage, and forcing every driver to ask a private company for permission to take a drive.

💡 This is a gross, unethical overreach that strips authority from parents while imposing state sanctioned identity verification on every adult who doesn't even have a child.

💡Additionally, people who pass a test, obtain a licence and drive a car aren't forced to use an app to constantly authenticate their suitability to drive.

🇪🇺"We do not let them buy alcohol until they are legally allowed"

💡False equivalence. We don't force every person to show ID at a shopping mall entrance just because a few people might buy alcohol with a meal at a restaurant. Some parents are okay with their 12 year-old going to the mall with friends while others aren't. Either way, it's their choice. Whatever irresponsible decisions some parents might make, every adult in the country shouldn't be forced to pay the price.

🇪🇺"It won't be foolproof"

💡This is all the proof we need to show that the EU and every government know that banning social media for teens won't protect them. When pressed by journalists about VPNs being used to circumvent a ban, politicians always state the ban isn't a silver bullet and will take time. The Mayor of London, Sadiq Khan went as far as to say "we know it's not the solution".

💡Either age verification works, or it doesn't. As a technical expert in this space, I can tell you there are no additional steps to take and no progress to be made. Either the approach does what it is supposed to do, or it's not fit for purpose. If they claim a bulletproof solution is coming, it can only mean one thing. They intend to ban or restrict VPNs to people who verify their identity.

🇪🇺"It will take time to invite the cultural change that is already taking shape in our society, just as it took time to outlaw drink driving, just as it took time to use seatbelts in the cars. Great change never happens overnight, but when it comes to our safety it is always worth it".

💡Comparing a social media ban and age verification to seatbelts is a completely broken analogy. Seatbelts are a safety feature that protects children while allowing them to travel in a car. A ban doesn't give kids a seatbelt. It kicks them out of the car entirely.

💡Instead of supporting parents who want to guide their own children through the digital world, this heavy-handed law strips away parental authority by banning the apps and websites that many parents are perfectly fine with and actively monitor.

💡Furthermore, enforcing these bans requires biometric age verification, which means forcing millions of adult citizens to scan their IDs, faces or credit cards just to browse the internet. That isn't a common-sense traffic law.

💡It's a digital checkpoint on every street. True safety means teaching kids how to navigate the digital world safely with real guardrails and parental guidance, not burning down digital spaces for everyone under the guise of protection.

🇪🇺☠️ The EU wants to ban teens from social media so every person is forced to verify their identity before they can read, share or post anything online. In their words, this is to protect children from dangerous content.

🇪🇺☠️ The EU wants to enforce "Chat Control" so every app has to monitor everything people say privately inside it, including apps with end-to-end encryption. In their words, this is to protect children from dangerous criminals.

💡Where this ends

🇪🇺 "If you want a picture of the future, imagine a boot stamping on a human face - forever".

George Orwell, 1984.

[Nixintel @nixintel]

@antibot4navalny showing how social media accounts used in info ops artificially inflate their engagement metrics.

This is also why likes and shares are weak and unreliable indicators for assessing the effectiveness of an IO campaign.

[bot blocker | блокировщик ботов @antibot4navalny]

Across 20 campaign posts targeting the US midterms, we proved with verifiable evidence that Matryoshka artificially inflates view counts and other engagement metrics.

While the average post in this campaign shows 56K views on X, only ~2.1K (3.8%) of them could be organic.